Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:122545
Precedence: bulk
MIME-Version: 1.0
References: <CAGBsUrera8cVE5nW1H6bCSok+gOjpHCyqutaCewoXEtYju-8yA@mail.gmail.com>
In-Reply-To: <CAGBsUrera8cVE5nW1H6bCSok+gOjpHCyqutaCewoXEtYju-8yA@mail.gmail.com>
Date: Sun, 3 Mar 2024 11:12:13 +0700
Message-ID: <CANLbj-roSPczd2V9wi_XGFVV5VKe7fLnUJ10dhu-yToGcLE1vw@mail.gmail.com>
Subject: Re: [PHP-DEV] [RFC] [Discussion] Deprecate GET/POST sessions
To: Kamil Tekiela <tekiela246@gmail.com>
Cc: PHP internals <internals@lists.php.net>
Content-Type: text/plain; charset="UTF-8"
From: ayesh@php.watch (Ayesh Karunaratne)

>
> Hi Internals,
>
> I would like to start a discussion on a new RFC
> https://wiki.php.net/rfc/deprecate-get-post-sessions
>
> Please let me know whether the idea is clear and the RFC is understandable.
>
> In particular, I am looking for any feedback as to why this is a bad
> idea. The primary motivation behind this RFC is to reduce potential
> security pitfalls.
>
> Regards,
> Kamil Tekiela

Hi Kamil,

I quite like the idea, and I think the RFC motivation, impact, and the
scope is clear as well.

The PHP 8.4 deprecations RFC also proposes to deprecate SID constant;
perhaps it's something worth mentioning in this RFC too?